This invention relates to distributed data processing systems. More specifically, the invention is concerned with a data processing system comprising a number of servers connected together by one or more interconnection routes. By a "server" is meant a unit that provides some service to the system; for example, a computer unit which provides a data processing service or an electronic mail service. The interconnection routes may, for example, comprise a local area network (LAN) or a telephone link.
The invention is particularly concerned with federated computer systems. A federated system is a distributed data processing system in which there is no central controller or data store. Each server is capable of operating autonomously, and there is no master unit for directing the operation of the system.
In such a system, servers can exchange information by setting up connections between them, by way of the interconnection routes. Each such connection between two servers is asymmetric, in that the server at one end starts the connection process. This server is referred to herein as the initiator, while the server at the other end is referred to as the responder.
In a federated system, one important consideration is that of security, i.e. of ensuring that only those with permission to access servers do so. In particular, when a connection is requested, some check has to be made concerning the validity of that connection. Thus, a check must be made as to whether the responder is sufficiently secure to meet the needs of the initiator, whether there is a suitable route between the two servers that will preserve the security of their conversations, and whether the responder is prepared to be used by the initiator.
This problem of providing security is made more difficult by the completely distributed nature of the system, and by the fact that there is no single central authority to control the security of the system.
The object of the present invention is to provide a novel way of overcoming the problem of providing security in a federated system.